A stored cross‑site scripting flaw exists in Stel Order versions 3.25.1 and earlier. The vulnerability resides in the /app/FrontController endpoint where the legalName and employeeID parameters are accepted without proper sanitization. Malicious code injected through these fields is persisted in the database and executed whenever other users or administrators view the affected pages, allowing an attacker to steal session cookies and hijack user accounts.

The affected product is Stel Order (vendor Stel Order). All releases up to and including version 3.25.1 are impacted; newer releases may not contain the flaw.

The CVSS score of 5.1 indicates moderate severity. EPSS is not provided and the vulnerability is not listed in CISA’s KEV, suggesting no known widespread exploitation at present. The likely attack vector is client‑side via the web application, where an attacker or a compromised user can submit malicious input. Once the input is stored, any user who accesses the affected sections will have the script executed in their browser, enabling theft of credentials and potential account takeover. The exploitation effort is low, requiring only that the attacker can place input into the vulnerable fields.